A flaw exists in Keycloak’s administrative REST API that allows an attacker to read sensitive role metadata without proper authorization. The vulnerability resides in the /admin/realms/{realm}/roles endpoint, where insufficient access-control checks enable the disclosure of protected information. The exposed data consists of role metadata that could assist attackers in understanding the application’s security posture and potentially plan further attacks.

The issue affects Red Hat builds of Keycloak 26.4 and the 26.4.11 patch release. Systems running these specific Red Hat packages are susceptible until updated to a patched build.

The CVSS score of 2.7 indicates a low severity rating, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Inferred from the description, the attack vector likely requires elevation within the administrative interface or access to the internal network to exploit the insufficient authorization. Without a valid admin session, an attacker would have limited capability to retrieve the sensitive role metadata.